Acronis warned customers to update its backup plugins for cPanel, WebHost Manager, and Plesk after disclosing a Linux flaw that can let a low-privileged user gain higher access on a server. The bug, CVE-2026-87886, is a local privilege-escalation vulnerability affecting Acronis Backup plugin for cPanel & WHM before 1.9.3.1021 and Acronis Backup extension for Plesk before 1.8.11; Acronis says it has seen limited, targeted exploitation based on a customer report.
Why it matters: Hosting providers and server administrators using these plugins could have vulnerable Linux systems that are easier for an attacker with limited access to take over further. Because exploitation may already be happening and Acronis is withholding technical details for now, affected users should install the fixed versions immediately.
info@thehackernews.com (The Hacker News)
2026.09.16
97% relevant
This appears to be the same underlying event: exploitation or suspected exploitation of CVE-2026-87886 in Acronis backup plugins for cPanel and Plesk. The new source narrows the focus to targeted attacks involving the cPanel plugin and reinforces the urgency of patching affected systems.
Ionut Arghire
2026.09.16
97% relevant
This source updates the same event by confirming Acronis has now released patches, reiterating that CVE-2026-87886 was exploited in limited targeted attacks against the cPanel & WHM plugin, and specifying fixed builds for both the cPanel plugin and the Plesk extension.
Bill Toulas
2026.09.15
100% relevant
This article appears to be the first tracked item here about CVE-2026-87886 in Acronis backup plugins for cPanel/WHM and Plesk, including Acronis' statement that exploitation may already be occurring.
← Back to all stories